Volume Shadow Copy Part 4

File History Windows 8 and 8.1

As mentioned in our second blog, the Volume Shadow Copy Service is still available on Windows 8. However, we have since discovered that on Windows 8.1 the service was removed, leaving File History to perform a similar function. Here is a brief overview of File History:

What is File History?

File History is Microsoft’s replacement to Windows Backup and Restore. File History replaced Windows System Restore and Backup after the older feature was discovered to be unpopular and difficult to use. File History was made with ease of use and automation in mind, so every user could backup and restore old/lost/damaged files.

To work file history, first you have to set up an external drive so that it has a place to save the files to. The rest is done by Windows. Every hour by default, Windows will scan your primary documents folder (on the C: drive) and check for any changes that have been made to any and all files. It then copies that newly saved or changed file to the external drive.

Also with File History, Windows creates a timeline of the files that it saves. For example, if you save a file accidentally after making unwanted changes, you can browse to that specific file and restore it from a point before you made that save. File History can also be configured to save backups from any major folder on the C: drive, including Pictures, Music, and Desktop.

About

The Senator Patrick Leahy Center for Digital Investigation (LCDI) is a world-class laboratory designed to international standards, focused on establishing and assisting with public and private sector initiatives surrounding cybercrime, digital forensics and information assurance. As a leader in the Digital Forensic higher education arena, Champlain College offers all students an opportunity to learn by participating in professional-level lab work at both undergraduate and graduate levels.

Recent Comments

John H Crawford, Jr. { This is a very powerful research objective. I would like to hear more in the future. John Crawford } – Feb 20, 9:10 AM